Auto-Maskin DCU 210E Dropbear SSH Server username/password hard-coded credentials
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
8.8 | $0-$5k | 0.00 |
A vulnerability, which was classified as critical, was found in Auto-Maskin DCU 210E (version unknown). Affected is an unknown function of the component Dropbear SSH Server. The manipulation of the argument username/password
with the input value root:amroot
leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of root / amroot. The server is configured to use password only authentication not cryptographic keys, however the firmware image contains an RSA host-key for the server. An attacker can exploit this vulnerability to gain root access to the Angstrom Linux operating system and modify any binaries or configuration files in the firmware. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.
The bug was discovered 10/06/2018. The weakness was released 10/08/2018 as confirmed advisory (CERT.org). The advisory is shared for download at kb.cert.org. This vulnerability is traded as CVE-2018-5399 since 01/11/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 05/23/2023). The MITRE ATT&CK project declares the attack technique as T1110.001.
The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k.
It is possible to mitigate the weakness by firewalling tcp/22 (ssh).
Product
Vendor
Name
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.8VulDB Meta Temp Score: 8.8
VulDB Base Score: 7.3
VulDB Temp Score: 7.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 9.8
NVD Vector: 🔍
CNA Base Score: 9.4
CNA Vector (CERT/CC): 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Hard-coded credentialsCWE: CWE-798 / CWE-259 / CWE-255
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: FirewallStatus: 🔍
0-Day Time: 🔍
Firewalling: 🔍
Timeline
01/11/2018 🔍10/06/2018 🔍
10/08/2018 🔍
10/08/2018 🔍
10/09/2018 🔍
05/23/2023 🔍
Sources
Advisory: kb.cert.orgStatus: Confirmed
CVE: CVE-2018-5399 (🔍)
Entry
Created: 10/09/2018 08:41Updated: 05/23/2023 11:51
Changes: 10/09/2018 08:41 (63), 03/31/2020 17:06 (1), 05/23/2023 11:51 (14)
Complete: 🔍
Cache ID: 13:524:103
No comments yet. Languages: en.
Please log in to comment.